Malicious code in swift-optimizer (npm)
swift-optimizer@1.1.0 on npm contains malicious postinstall code that fetches and executes a binary from Azure blob storage. The attack is targeted to specific organizations via hardcoded victim fingerprints derived from domain and hostname hashes.
- Disclosed
- Last updated
- Blast radius
- Targeted to specific organizations via hardcoded victim guardrails; blast radius limited to users of swift-optimizer@1.1.0 on npm who match pre-identified organizational fingerprints.
- Ecosystems
- Attack vectors
- Affected entities
- swift-optimizer · 1.1.0
swift-optimizer@1.1.0 on npm includes a postinstall hook (scripts/install-binary.js) that executes a hand-rolled JavaScript bytecode VM (~123 KB) designed to evade source-level scanning. The bytecode contains a base64-encoded constant pool that hides all install-time behavior from static analysis.
The decoded behavior reveals a multi-stage attack: (1) A dropper fetches a binary from https://telemetry021312.blob.core.windows.net/share/?v= using a spoofed Edge User-Agent, writes it to bin/swift-optimizer-[platform].exe, and sets executable permissions. The binary is stored on anonymous Azure blob storage with an unpinned URL and no hash verification. (2) A targeted-victim guardrail reads environment variables (USERDNSDOMAIN, USERDOMAIN, USERDOMAIN_ROAMINGPROFILE), hostname, and internal IP information, hashes them with SHA-256, and only proceeds if the digest matches one of three hardcoded values, restricting execution to pre-identified victim organizations. (3) Sandbox evasion logic issues an HTTPS HEAD request to RFC1918 address https://10.100.135.17/ with certificate verification disabled to detect sandbox/test environments.
The package's main Optimizer API is wired to invoke the downloaded binary at runtime, enabling arbitrary code execution on affected systems. The attack infrastructure (Azure blob storage domain) has no stated relationship to the package author or homepage.
Indicators of compromise
- Packages
- swift-optimizer
- Domains
- telemetry021312.blob.core.windows.net
- IPs
- 10.100.135.17
Remediation
- Immediately uninstall swift-optimizer@1.1.0 and any dependent packages
- Audit npm install logs and process execution history for the affected version
- Scan systems for the presence of bin/swift-optimizer-* binaries and associated artifacts
- Review environment variables and network connections from the install period
- If your organization's domain/hostname hash matches a guardrail digest, assume compromise and conduct forensic investigation
- Update to a patched version if available, or use an alternative package
- Implement npm package pinning and integrity verification (npm ci with package-lock.json)
- Monitor for suspicious binary execution from node_modules/.bin/ directories
Sources
- GitHub Advisory GHSA-2857-88rw-5pqc · GitHub Advisory Database
Cite this entry
"Malicious code in swift-optimizer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-swift-optimizer-npm-1vlb1n
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g2-ssr (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g2-ssr, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g6-extension-3d (npm)
A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/g6-extension-3d, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/gi-assets-basic (npm)
A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages, including @antv/gi-assets-basic, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit